Waseel: driver capture, chat/calls, dispatch, and session fixes

Driver onboarding now photographs the licence, ID card and vehicle
registration and reads the credential fields off them, plus a camera-only
profile selfie riders check the arriving driver against. Adds in-app chat
and WebRTC calls, push-backed ride offers, ratings, cancellation and
payment sheets, settlement, and the owner dashboard endpoints behind them.

Camera permission on Android:
  - Declare CAMERA and READ_MEDIA_IMAGES in the manifest. expo-image-picker's
    own plugin never declares CAMERA, and Android denies a request for an
    undeclared permission instantly and silently — no dialog is ever shown,
    which is indistinguishable from the app not asking at all.
  - Handle canAskAgain: once Android stops showing the dialog, repeating why
    we need it is a dead end, so offer Open Settings instead (lib/capture-
    permission.ts), matching what the location flow already did.

Session: a 401 on a request that carried a token now ends the session
instead of being reinterpreted per-screen — driver-home had been reading it
as "this user has no driver profile" and showing an onboarding form to an
already-onboarded driver. Requests without a token are exempt so a failed
sign-in doesn't sign you out, and the notification is latched per token so
concurrent polls tear the session down once. (root) gains the auth guard
that turns that into the sign-in screen; app/index.tsx only guarded the way
in, leaving a session that ended mid-screen with nowhere to go.

Also ignore .uploads/ — it holds driver licence, ID and vehicle scans plus
profile photos, which are personal data and must not be committed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

lib/ride-participants.ts

@@ -0,0 +1,80 @@
+// Shared ownership + liveness checks for anything scoped to a ride that both
+// the rider and the assigned driver can touch (chat messages, calls). A
+// rider authenticates via requireAuth (users.id UUID); a driver authenticates
+// via requireDriverProfile (drivers.id INT). Because a single user account can
+// be both a rider and a driver, we check the RIDER path first — otherwise a
+// user who is also a driver would be misrouted to the driver branch for their
+// own ride.
+
+import { requireAuth } from "@/lib/jwt";
+import { requireDriverProfile } from "@/lib/driver";
+import { sql } from "@/lib/db";
+import { CONNECTED_STATUS_ARRAY } from "@/lib/ride-lifecycle";
+
+export type RideParticipant =
+  | { role: "rider"; userId: string; driverId: null }
+  | { role: "driver"; userId: string; driverId: number };
+
+export type ParticipantError = { error: Response };
+
+// Proves the caller is the ride's rider or its assigned driver and returns
+// which one, so the caller can stamp sender_type / caller_type. Returns a
+// ready-to-ship 403/401 error Response otherwise.
+export const requireRideParticipant = async (
+  req: Request,
+  rideId: number,
+): Promise<RideParticipant | ParticipantError> => {
+  // Rider path first: a user who owns the ride.
+  const auth = requireAuth(req);
+  if (!("error" in auth)) {
+    const riderRows = await sql<{ user_id: string }>`
+      SELECT user_id FROM rides WHERE ride_id = ${rideId} AND user_id = ${auth.userId}
+    `;
+    if (riderRows[0]) {
+      return { role: "rider", userId: auth.userId, driverId: null };
+    }
+  }
+
+  // Driver path: a user with a driver profile assigned to the ride.
+  const driver = await requireDriverProfile(req);
+  if ("error" in driver) {
+    // If the request had no valid auth at all, surface that 401 rather than a
+    // generic 403, so the client can re-authenticate.
+    if ("error" in auth) return { error: auth.error };
+    return {
+      error: Response.json(
+        { error: "You are not part of this ride." },
+        { status: 403 },
+      ),
+    };
+  }
+
+  const driverRows = await sql<{ ride_id: number }>`
+    SELECT ride_id FROM rides WHERE ride_id = ${rideId} AND driver_id = ${driver.driverId}
+  `;
+  if (!driverRows[0]) {
+    return {
+      error: Response.json(
+        { error: "You are not part of this ride." },
+        { status: 403 },
+      ),
+    };
+  }
+
+  return {
+    role: "driver",
+    userId: driver.auth.userId,
+    driverId: driver.driverId,
+  };
+};
+
+// A ride is "active" (chat/call allowed) while a driver is assigned and the
+// ride is en route to or past acceptance but not yet terminal.
+export const rideIsActive = async (rideId: number): Promise<boolean> => {
+  const rows = await sql<{ status: string }>`
+    SELECT status FROM rides
+    WHERE ride_id = ${rideId} AND driver_id IS NOT NULL
+      AND status = ANY(${CONNECTED_STATUS_ARRAY}::text[])
+  `;
+  return Boolean(rows[0]);
+};